diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 0957434c2..177e98b92 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -27,7 +27,7 @@ jobs:
         with:
           persist-credentials: false
           lfs: true
-      - uses: opalmedapps/.github/.github/actions/docker-build@main
+      - uses: opalmedapps/.github/.github/actions/docker-build@c4370fac27e3347093784a56e2eaca34f7c4e283 # main
         id: build-image
         with:
           registry: ${{ env.REGISTRY }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 47dee9e12..e6e9d7126 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -57,7 +57,7 @@ jobs:
           prek-version: "0.3.8"
         env:
           SKIP: ruff,ruff-format,mypy,markdownlint-cli2,reuse-lint-file
-      - uses: opalmedapps/actions/actions/check-thirdparty-notice@main
+      - uses: opalmedapps/actions/actions/check-thirdparty-notice@233b2b31efb64f969c8a8801990f342c9213e86f # main
         if: '!cancelled()'
         with:
           pyproject-file: './pyproject.toml'
@@ -194,10 +194,10 @@ jobs:
   markdownlint:
     permissions:
       contents: read
-    uses: opalmedapps/.github/.github/workflows/markdownlint.yaml@main
+    uses: opalmedapps/.github/.github/workflows/markdownlint.yaml@c4370fac27e3347093784a56e2eaca34f7c4e283 # main
 
   run-reuse-workflow:
-    uses: opalmedapps/.github/.github/workflows/reuse.yaml@main
+    uses: opalmedapps/.github/.github/workflows/reuse.yaml@c4370fac27e3347093784a56e2eaca34f7c4e283 # main
 
   build-docs:
     runs-on: ubuntu-latest